GDPR training for school staff covers how teachers, TAs, office staff and SENCOs handle pupil data, safeguarding records and staff information under UK GDPR and the Data Protection Act 2018 — this guide breaks down what to look for and which training route fits which role in 2026.
- GDPR training for school staff must cover pupil data, SEN records and breach reporting, with annual refreshers standard in 2026.
- Whole-school INSET sessions beat generic e-learning for embedding UK GDPR rules — buy the role-specific route.
- A 30-45 minute refresher module suits low-risk staff; office teams and SENCOs need deeper, role-specific training.
- Skip generic corporate GDPR courses that ignore Data Protection Act 2018 rules on pupil and safeguarding records.
Why this matters
Schools hold some of the most sensitive personal data in the country: SEN records, safeguarding files, medical information, exam results, staff HR records. A breach involving a child's data draws more scrutiny from the Information Commissioner's Office than almost any other sector, and Ofsted inspectors expect evidence that staff understand data handling as part of wider safeguarding and CPD compliance.
Generic GDPR courses built for offices and retail miss the specifics schools need: consent for photos, data sharing with local authorities, retention periods for pupil files, and what counts as a reportable breach when a laptop with class lists goes missing. Bright Pathway builds its qualification catalogue around exactly this kind of role-specific compliance training for education staff, which is the lens this guide uses.
Who this is for
This guide is for school business managers, headteachers and HR leads deciding how to roll out GDPR training across a staff body that ranges from classroom teachers to office administrators, TAs, SENCOs and site staff. Each role touches data differently — a TA supporting a child with an EHCP handles more sensitive records than a lunchtime supervisor — so a single one-size course rarely covers the risk properly. If you're choosing between a whole-staff INSET session, a role-tiered online course, or a short annual refresher, the criteria below apply whether you're a single primary academy or a multi-academy trust.
What to look for in GDPR training for school staff
Coverage of pupil data specifically
Generic GDPR courses talk about customer records and marketing consent — neither applies in a school. Training needs to cover pupil records, SEN and EHCP data, safeguarding case files, and photo/video consent explicitly, because these are the categories that generate ICO complaints from parents.
Alignment with Data Protection Act 2018 and UK GDPR
Post-Brexit, UK schools sit under UK GDPR and the Data Protection Act 2018, not the EU regulation. A course still referencing only the EU version, or written for a different jurisdiction, will miss the school-specific exemptions around safeguarding disclosures that matter in practice.
Breach reporting procedure built in
Staff need to know the 72-hour reporting window to the ICO and, more importantly, who to tell first inside the school. Training that stops at "report a breach" without naming the internal escalation route (usually the Data Protection Officer or headteacher) leaves a gap that shows up during an actual incident.
Role-tiered content, not one-size training
Office staff handling admissions data need deeper training than a cover supervisor who never touches a pupil file. Look for courses split by role, similar to how safeguarding training for teaching assistants is pitched differently than safeguarding leads' training — the same tiering logic should apply to data protection.
CPD recognition and record-keeping
GDPR training should count toward a staff member's annual CPD hours and sit in their training record alongside safeguarding and first aid certificates. If a course issues a certificate with no CPD hour value attached, it's harder to evidence at an Ofsted inspection or DBS-linked safer recruitment check — the same record-keeping discipline schools already apply when they get a DBS check for teaching assistant roles.
Refresh cycle matched to risk
Annual refreshers are the norm for 2026 in most multi-academy trusts, but staff who handle SEN or safeguarding data more directly often need a mid-year top-up when policy changes — a new data sharing agreement with a local authority, for example.
Training routes for school staff — what actually works
The safe pick: role-tiered online GDPR course. Split by role (teaching staff, office staff, TAs, leadership), typically 45-90 minutes per tier, with a short assessment and certificate at the end. Works for schools rolling out training across 30+ staff without pulling everyone into one room. Buy — this is the most efficient route for most schools in 2026 and scales cleanly across a trust.
The thorough one: DPO-led whole-school INSET session. A half-day or full INSET slot led by the school's Data Protection Officer, covering live case studies specific to that school's systems (MIS platform, safeguarding software, parent communication tools). Best for the start of an academic year or after a near-miss incident. Consider if your school has an active DPO and can free up an INSET day — the specificity is worth the time cost.
The quick fix: 30-45 minute annual refresher module. A short online module for staff who've already completed full GDPR induction and just need an annual top-up on policy changes and breach reporting. Fine for low-risk roles like lunchtime staff or site teams. Buy for refreshers, skip as a first-time course — it moves too fast to build real understanding for someone new to the sector.
The wildcard: sector webinars and ICO guidance sessions. Free or low-cost sessions run by sector bodies and the Information Commissioner's Office itself, useful for staying current on enforcement trends and case studies. Not a substitute for structured, certificated training but a strong supplement. Consider as a top-up, not a standalone course.
What to avoid
- Generic corporate GDPR e-learning with no schools module. It covers marketing consent and customer databases, not pupil records or safeguarding disclosures — the exact scenarios that actually generate risk in a school.
- One-off training with no refresher built in. A single session in 2022 or 2023 does not cover a staff member for 2026; policies and data-sharing agreements change, and untrained staff on old guidance are the most common source of breaches.
- Courses that skip the internal escalation route. Knowing the ICO's 72-hour rule is useless if staff don't know who inside the school to tell first — check the course names an internal contact step, not just the regulator.
Verdict comparison
| Training route | Format | Typical length | CPD recognised | Verdict |
|---|---|---|---|---|
| Role-tiered online course | Online, self-paced | 45-90 min per role | Yes | Buy |
| DPO-led INSET session | In-person, whole staff | Half or full day | Yes, if certificated | Consider |
| Annual refresher module | Online, short-form | 30-45 min | Yes | Buy for refreshers |
| ICO/sector webinar | Live or recorded webinar | 30-60 min | Rarely | Consider as supplement |
FAQ
What’s the best GDPR training for school staff in 2026?
A role-tiered online course that splits content by job function (teaching staff, office staff, TAs, leadership) is the strongest general choice for 2026 because it covers pupil-data scenarios each role actually encounters. Whole-school INSET sessions led by a Data Protection Officer work well as a periodic deeper dive rather than the everyday default.
Is GDPR training mandatory for teaching assistants?
There’s no single statutory rule naming GDPR training for teaching assistants specifically, but any staff member handling pupil records, SEN data or safeguarding files is expected to understand UK GDPR obligations under the Data Protection Act 2018. Most schools treat it as mandatory alongside safeguarding training for anyone with pupil data access.
How often should school staff refresh GDPR training?
Annually is the standard refresh cycle for most schools and multi-academy trusts heading into 2026, with a mid-year top-up if data-sharing agreements or internal policy change. Staff in higher-risk roles like SENCOs or office administrators sometimes need refreshers more frequently.
How much does GDPR training for schools cost?
Costs vary widely by format and provider, from free guidance sessions run by the Information Commissioner’s Office to paid accredited online courses with certification. Check current pricing directly with individual training providers since packages differ by staff numbers and depth of content.
Does GDPR training count towards CPD hours?
Yes, when the course issues a certificate with a stated CPD hour value, which most accredited providers do. Schools log this alongside safeguarding and first aid certificates in each staff member’s training record.
What’s the difference between GDPR training and safeguarding training?
GDPR training covers how personal and pupil data is collected, stored, shared and reported on if breached, while safeguarding training covers recognising and responding to welfare concerns. They overlap where safeguarding case files are the data in question, which is why some schools deliver both together.
Who needs GDPR training in a school — all staff or just office staff?
All staff with any access to pupil, staff or parent data need some level of GDPR awareness, but the depth should scale with the role. Office administrators and SENCOs handling detailed records need deeper training than site or catering staff with minimal data access.
Can GDPR training be done online?
Yes, online role-tiered courses are the most common format for schools in 2026 because they scale across large staff bodies without pulling everyone out of timetabled duties. In-person INSET sessions still have a place for whole-school policy launches or after an incident.
One last thing
The biggest gap isn't the training course itself — it's the record. Schools that pass Ofsted scrutiny on data handling aren't the ones with the fanciest GDPR module; they're the ones who can pull up a staff training log showing who completed what and when, the same discipline applied to Prevent duty training courses and other statutory modules. Build the tracking habit before you pick the course.
Related guides
- How CPD hours work and how to record them for teaching staff
- Prevent duty training courses for schools
